ASD ISM 1885Implement Emanation Security Measures for Systems
Official control statement
Recommended actions contained within emanation security mitigation advice issued for systems are implemented by system owners.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
System owners follow security advice to protect against information leaks from electronic devices.
What this means in practice
This control is about keeping information that comes from electronic devices secure so it doesn't get accidentally leaked. Imagine if someone nearby could pick up valuable information from your computer without even touching it-that's the risk if this isn't managed.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
S, TS
ISM last updated
Mar 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Section
Emanation securityTopic
Emanation security risk assessments
Why it matters
Without this control, sensitive company data could be intercepted without any physical break-in, leading to potential data breaches and business harm.
Operational notes
Regularly review and update device lists and protection methods to keep up with changing technology and emerging threats.
Implementation tips
- System owners should consult with their IT team to understand which equipment can emit harmful signals. Begin by creating an inventory of systems that might be susceptible, then categorise each based on the type of emissions they produce.
- The IT team should implement shields and filters on equipment identified as a risk. Use specialised materials and techniques, such as installing devices in shielded rooms or using enclosures that block emissions.
- Managers should train staff on the importance of TEMPEST measures. Organise a training session to explain why it's critical to prevent emissions and demonstrate simple practices that help minimise risks, like ensuring devices are turned off after use in secure spaces.
- Procurement officers should ensure that new equipment purchases include TEMPEST-certified products. Check product specifications for compliance with TEMPEST standards before purchasing and avoid buying from vendors that cannot guarantee this compliance.
- The security team should regularly review and update TEMPEST protection measures. Schedule quarterly reviews to ensure that the measures are still effective and note any changes in technology or working environments that might require an adjustment to existing protections.
Audit / evidence tips
- AskThe equipment emissions inventory: Request to see the list that identifies all equipment assessed for emissionsLook atDates, types of systems, and categorisation detailsGoodA comprehensive list with recent dates and clear categories based on risk levels
- AskDocumentation on shielding measures: Request descriptions or photographs of how equipment has been shieldedLook atThe materials used and where they are deployed. Good is consistent use of approved shielding methods on high-risk equipment
- AskTraining records: Request logs from any training sessions or awareness activitiesLook atAttendance lists and the topics covered. Good are records showing high attendance and specific focus on TEMPEST principles
- AskProcurement records of TEMPEST-compliant equipment: Request purchase orders or receipts for recent equipmentLook atDetails on the vendor and compliance notes in the specifications. Good is documentation showing recent purchases are compliant with TEMPEST standards
- AskRecent review records: Request reports from any audit or review relating to TEMPEST measuresLook atWho performed the review and any suggested improvements. Good includes a clear follow-up action plan with responsible individuals and timelines
Cross-framework mappings
How ISM-1885 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.27 | ISM-1885 requires implementation of specific emanation security measures as prescribed by ASD mitigation advice for systems | |
sync_altPartially overlaps(1)expand_less | ||
| Annex A 8.12 | ISM-1885 requires system owners to implement emanation security mitigation advice to reduce the risk of information leakage via electroma... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Communications infrastructure
See all Guidelines for communications infrastructure controls, or browse the full ASD ISM library.